Microsoft Teams Integration

The Infracast Microsoft Teams integration sends notifications to your Teams channels via an Incoming Webhook connector. Receive alerts for new critical findings, discovery completions, and job failures directly in Teams.

Prerequisites

• A Microsoft Teams workspace where you have channel management permissions
• Permission to add connectors to a Teams channel

Creating a Teams Incoming Webhook

1. Open Microsoft Teams and navigate to the channel you want to receive notifications (e.g., Security Alerts)
2. Click the ... (More options) next to the channel name
3. Select Connectors (or Edit channel → Connectors in newer Teams)
4. Search for Incoming Webhook and click Configure
5. Give it a name: Infracast
6. Optionally upload an icon
7. Click Create
8. Copy the generated webhook URL (format: https://yourcompany.webhook.office.com/webhookb2/...)
9. Click Done

tip

For Microsoft 365 tenants that have disabled legacy connectors (the O365 Connectors deprecation), use a Power Automate flow with an HTTP trigger as an alternative incoming webhook endpoint. Contact your M365 admin if the Connectors option is not available.

Configuring the Integration

Navigate to Settings → Integrations → Add Integration → Microsoft Teams:

Field	Description
Webhook URL	The Teams incoming webhook URL
Notify on: New Critical Finding	Send an adaptive card when a Critical finding is created
Notify on: New High Finding	Send an adaptive card when a High finding is created
Notify on: Discovery Complete	Send a summary card when a discovery job finishes
Notify on: Discovery Failed	Send an alert card when a discovery job fails
Minimum Severity	Only notify for findings at or above this severity

Notification Format

Infracast sends Adaptive Cards to Teams for rich formatting:

New finding notification:

🚨 Critical Finding Detected
──────────────────────────────
Finding:   CVE-2024-1234 — Remote Code Execution
Asset:     web-server-01 (aws.ec2.instance)
CVSS:      9.8 (Critical)
Plugin:    AWS
Detected:  June 10, 2024 12:00 UTC

[View in Infracast] [View Asset]

Discovery completion notification:

✅ Discovery Complete — aws-prod
──────────────────────────────
Duration:   4m 32s
New Assets: 12
Updated:    47
New Findings: 3

[View Discovery Details]

Troubleshooting

400 Bad Request from webhook

Symptom: Error: Teams webhook request failed: 400

Checks:

1. Verify the webhook URL is complete and not truncated when copied
2. The webhook URL must be sent a JSON payload with a type of message. Infracast handles this automatically — verify the integration configuration is saved correctly.
3. Test the webhook manually:

   curl -X POST "YOUR_WEBHOOK_URL" \
     -H "Content-Type: application/json" \
     -d '{"text": "Infracast test message"}'

Webhook URL expired

Symptom: Notifications were working but have stopped with a 410 Gone response

Cause: Teams incoming webhook URLs can expire or be revoked when the connector is removed or the channel is reconfigured.

Fix:

1. Go back to the Teams channel → Connectors
2. If the Incoming Webhook connector is missing, re-add it and generate a new URL
3. Update the Infracast integration with the new URL

Connector option not available (O365 deprecation)

Symptom: The Connectors option is not visible in the Teams channel settings

Cause: Microsoft is deprecating Office 365 Connectors in some tenants.

Fix: Create a Power Automate flow:

1. Open Power Automate
2. Create a new flow: Instant cloud flow → When an HTTP request is received
3. Add an action: Post a message in a chat or channel → select the Teams channel
4. Copy the generated HTTP POST URL and use it as the Webhook URL in Infracast

Adaptive Card formatting issues

Symptom: Notifications appear as raw JSON or without formatting in Teams

Cause: Some versions of Teams or Teams clients may render Adaptive Cards differently.

Fix: Verify the Teams desktop/web client is up to date. Infracast sends Adaptive Card v1.3 payloads which are supported by Teams desktop and web clients.